pam_unix_* Service Modules - Working With Oracle® Solaris 11.2 Directory and Naming Services: LDAP

Language:

`pam_unix_*` Service Modules

If the /etc/pam.conf file is unconfigured, UNIX authentication is enabled by default.

Note - The pam_unix module has been removed and is no longer supported in Oracle Solaris. The module has been replaced by a different set of service modules that provides equivalent or greater functionality. In this guide, pam_unix refers to the modules that provide equivalent functionality, not to the pam_unix module itself.

The following modules provide the equivalent functionality as the original pam_unix module. The modules are listed by using their corresponding man pages.

	`pam_authtok_check`(5)
	`pam_authtok_get`(5)
	`pam_authtok_store`(5)
	`pam_dhkeys`(5)
	`pam_passwd_auth`(5)
	`pam_unix_account`(5)
	`pam_unix_auth`(5)
	`pam_unix_cred`(5)
	`pam_unix_session`(5)

The pam_unix_* modules follow the traditional model of UNIX authentication:

The client retrieves the user's encrypted password from the name service.
The user is prompted for the user's password.
The user's password is encrypted.
The client compares the two encrypted passwords to determine whether the user should be authenticated.

The pam_unix_* modules have the following restrictions:

The password must be stored in UNIX crypt format.
The userPassword attribute must be readable by the name service.

For example, if you set the credential level to anonymous, then anyone must be able to read the userPassword attribute. Similarly, if you set the credential level to proxy, then the proxy user must be able to read the userPassword attribute.

Note - UNIX authentication is incompatible with the sasl/digest-MD5 authentication method. In Oracle Directory Server Enterprise Edition, to use digest-MD5, passwords must be stored unencrypted. UNIX authentication requires the password be stored in crypt format.

The pam_unix_account module supports account management when the enableShadowUpdate switch is set to true. The controls for a remote LDAP user account are applied in the same manner that controls are applied to a local user account that is defined in the passwd and shadow files. For the LDAP account in enableShadowUpdate mode, the system updates and uses the shadow data on the LDAP server for password aging and account locking. The shadow data of the local account only applies to the local client system, while the shadow data of an LDAP user account applies to the user on all client systems.

Password history checking is only supported for the local client, and not for an LDAP user account.